Static task
static1
Behavioral task
behavioral1
Sample
bced727c887f7433ee15a8eca3f93420N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bced727c887f7433ee15a8eca3f93420N.exe
Resource
win10v2004-20240709-en
General
-
Target
bced727c887f7433ee15a8eca3f93420N.exe
-
Size
463KB
-
MD5
bced727c887f7433ee15a8eca3f93420
-
SHA1
d8a0ac41736a77baab274cbed4c72ae06a021219
-
SHA256
f251ad0efe1718e125f431deae9ed1fef246799279154bff82157f15b5bbffb4
-
SHA512
9420bf72b7530d5e63e4ae313caa04141263a14c642686572bc1377a46a923896ebf799cc3d07aa4b6635d757a8a74231bb6b1faf58b6819ba9c610e7c40ebd8
-
SSDEEP
12288:Fzkobtbb4HGT0U/P/K6pgrSFSBBOSGSwYCM62QLPfmK727dH/CVe2V:rJtVAtf62QLOX7dH/CYu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bced727c887f7433ee15a8eca3f93420N.exe
Files
-
bced727c887f7433ee15a8eca3f93420N.exe.exe windows:4 windows x86 arch:x86
8415a2195182f8940548f4e68a2b9960
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
SheChangeDirExW
ShellExecuteExA
SHLoadInProc
CommandLineToArgvW
SHGetMalloc
DoEnvironmentSubstA
SHGetSettings
ShellExecuteEx
SheChangeDirA
wininet
InternetDialW
InternetCrackUrlW
FindNextUrlCacheContainerW
DeleteUrlCacheContainerW
FindNextUrlCacheContainerA
GetUrlCacheEntryInfoExA
FreeUrlCacheSpaceA
ShowSecurityInfo
GopherCreateLocatorA
InternetGetConnectedStateEx
UnlockUrlCacheEntryFileW
InternetSetCookieA
DeleteUrlCacheEntryA
FindFirstUrlCacheEntryExW
FindNextUrlCacheEntryExW
InternetTimeToSystemTimeA
FtpRenameFileA
HttpAddRequestHeadersW
FindNextUrlCacheEntryExA
InternetAlgIdToStringA
CreateUrlCacheEntryW
FtpFindFirstFileA
InternetSetDialStateW
FtpGetFileSize
FtpRenameFileW
comdlg32
PageSetupDlgA
GetFileTitleW
ChooseColorW
PrintDlgA
ReplaceTextA
advapi32
RegQueryMultipleValuesW
CryptGenKey
CryptDeriveKey
RegQueryInfoKeyW
RegEnumValueW
RegOpenKeyW
RegQueryValueExA
CryptEnumProvidersA
RegCreateKeyA
DuplicateToken
CryptGenRandom
AbortSystemShutdownA
RegConnectRegistryA
CryptGetProvParam
CryptDestroyHash
RegSetValueExA
RegDeleteKeyA
LookupAccountNameA
LookupPrivilegeValueA
RegSetValueA
RegQueryValueA
kernel32
HeapAlloc
VirtualAlloc
HeapFree
InitializeCriticalSection
SetConsoleCtrlHandler
CompareStringA
GetFileType
HeapSize
SetUnhandledExceptionFilter
FreeLibrary
GetLastError
GetCurrentThreadId
GetVersionExW
RtlUnwind
GetProcessHeap
GetStartupInfoW
IsValidCodePage
GetStdHandle
GetCurrentProcess
RemoveDirectoryA
HeapReAlloc
GetStringTypeA
InterlockedExchange
GetAtomNameW
TlsFree
GetCalendarInfoW
VirtualFree
HeapDestroy
UnhandledExceptionFilter
GetUserDefaultLCID
InterlockedDecrement
TlsAlloc
MultiByteToWideChar
WaitForSingleObjectEx
DeleteFiber
SetHandleCount
GetSystemTimeAsFileTime
VirtualUnlock
ReadConsoleInputA
HeapCreate
GetEnvironmentStringsW
RtlZeroMemory
CompareStringW
SetEnvironmentVariableA
GlobalUnfix
GetModuleHandleA
FreeEnvironmentStringsW
ReadConsoleOutputCharacterW
GetCurrentThread
GetLocaleInfoA
GetCPInfo
ReleaseMutex
GetProcAddress
CreateProcessA
GetModuleFileNameA
GetDateFormatA
GetTimeZoneInformation
GetStringTypeW
lstrcat
IsValidLocale
GetModuleFileNameW
GetLocaleInfoW
LeaveCriticalSection
LoadLibraryA
GetCommandLineA
LCMapStringA
GetACP
GetCurrentProcessId
QueryPerformanceCounter
GetPrivateProfileStructW
GetTickCount
DeleteCriticalSection
GetCommandLineW
ExitThread
LCMapStringW
EnterCriticalSection
WriteFile
VirtualQuery
IsDebuggerPresent
ExitProcess
TlsSetValue
GetStringTypeExW
GetSystemDirectoryA
GetThreadTimes
TlsGetValue
GetEnvironmentStrings
SetLastError
TerminateProcess
WideCharToMultiByte
GetVersionExA
EnumSystemLocalesA
GetStartupInfoA
GetOEMCP
GetTimeFormatA
InterlockedIncrement
DeleteFileW
Sleep
FreeEnvironmentStringsA
Sections
.text Size: 145KB - Virtual size: 144KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 312KB - Virtual size: 312KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ